Available:*
Library | Item Barcode | Call Number | Material Type | Item Category 1 | Status |
---|---|---|---|---|---|
Searching... | 30000010370279 | TK5105.59 M47 2017 | Open Access Book | Book | Searching... |
On Order
Summary
Summary
Intensively hands-on training for real-world network forensics
Network Forensics provides a uniquely practical guide for IT and law enforcement professionals seeking a deeper understanding of cybersecurity. This book is hands-on all the way--by dissecting packets, you gain fundamental knowledge that only comes from experience. Real packet captures and log files demonstrate network traffic investigation, and the learn-by-doing approach relates the essential skills that traditional forensics investigators may not have. From network packet analysis to host artifacts to log analysis and beyond, this book emphasizes the critical techniques that bring evidence to light.
Network forensics is a growing field, and is becoming increasingly central to law enforcement as cybercrime becomes more and more sophisticated. This book provides an unprecedented level of hands-on training to give investigators the skills they need.
Investigate packet captures to examine network communications Locate host-based artifacts and analyze network logs Understand intrusion detection systems--and let them do the legwork Have the right architecture and systems in place ahead of an incidentNetwork data is always changing, and is never saved in one place; an investigator must understand how to examine data over time, which involves specialized skills that go above and beyond memory, mobile, or data forensics. Whether you're preparing for a security certification or just seeking deeper training for a law enforcement or IT role, you can only learn so much from concept; to thoroughly understand something, you need to do it. Network Forensics provides intensive hands-on practice with direct translation to real-world application.
Author Notes
Ric Messier has been program director for various cyber-security and computer forensics programs at Champlain College. A veteran of the networking and computer security field since the early 1980s, he has worked at large Internet service providers and small software companies. He has been responsible for the development of numerous course materials, has served on incident response teams, and has been consulted on forensic investigations for large companies.
Table of Contents
Introduction | p. xxi |
1 Introduction to Network Forensics | p. 1 |
What Is Forensics? | p. 3 |
Handling Evidence | p. 4 |
Cryptographic Hashes | p. 5 |
Chain of Custody | p. 8 |
Incident Response | p. 8 |
The Need for Network Forensic Practitioners | p. 10 |
Summary | p. 11 |
References | p. 12 |
2 Networking Basics | p. 13 |
Protocols | p. 14 |
Open Systems Interconnection (OSI) Model | p. 16 |
TCP/IP Protocol Suite | p. 18 |
Protocol Data Units | p. 19 |
Request for Comments | p. 20 |
Internet Registries | p. 23 |
Internet Protocol and Addressing | p. 25 |
Internet Protocol Addresses | p. 28 |
Internet Control Message Protocol (ICMP) | p. 31 |
Internet Protocol Version 6 (IPv6) | p. 31 |
Transmission Control Protocol (TCP) | p. 33 |
Connection-Oriented Transport | p. 36 |
User Datagram Protocol (UDP) | p. 38 |
Connectionless Transport | p. 39 |
Ports | p. 40 |
Domain Name System | p. 42 |
Support Protocols (DHCP) | p. 46 |
Support Protocols (ARP) | p. 48 |
Summary | p. 49 |
References | p. 51 |
3 Host-Side Artifacts | p. 53 |
Services | p. 54 |
Connections | p. 60 |
Tools | p. 62 |
Netstat | p. 63 |
Nbstat | p. 66 |
Ifconfig/ipconfig | p. 68 |
Sysinternals | p. 69 |
Ntop | p. 73 |
Task Manager/Resource Monitor | p. 75 |
ARP | p. 77 |
/Proc Filesystem | p. 78 |
Summary | p. 79 |
4 Packet Capture and Analysis | p. 81 |
Capturing Packets | p. 82 |
Tcpdump/Tshark | p. 84 |
Wireshark | p. 89 |
Taps | p. 91 |
Port Spanning | p. 93 |
ARP Spoofing | p. 94 |
Passive Scanning | p. 96 |
Packet Analysis with Wireshark | p. 98 |
Packet Decoding | p. 98 |
Filtering | p. 101 |
Statistics | p. 102 |
Following Streams | p. 105 |
Gathering Files | p. 106 |
Network Miner | p. 108 |
Summary | p. 110 |
5 Attack Types | p. 113 |
Denial of Service Attacks | p. 114 |
SYN Floods | p. 115 |
Malformed Packets | p. 118 |
UDP Floods | p. 122 |
Amplification Attacks | p. 124 |
Distributed Attacks | p. 126 |
Backscatter | p. 128 |
Vulnerability Exploits | p. 130 |
Insider Threats | p. 132 |
Evasion | p. 134 |
Application Attacks | p. 136 |
Summary | p. 140 |
6 Location Awareness | p. 143 |
Time Zones | p. 144 |
Using whois | p. 147 |
Traceroute | p. 150 |
Geolocation | p. 153 |
Location-Based Services | p. 156 |
WiFi Positioning | p. 157 |
Summary | p. 158 |
7 Preparing for Attacks | p. 159 |
NetFlow | p. 160 |
Logging | p. 165 |
Syslog | p. 166 |
Windows Event Logs | p. 171 |
Firewall Logs | p. 173 |
Router and Switch Logs | p. 177 |
Log Servers and Monitors | p. 178 |
Antivirus | p. 180 |
Incident Response Preparation | p. 181 |
Google Rapid Response | p. 182 |
Commercial Offerings | p. 182 |
Security Information and Event Management | p. 183 |
Summary | p. 185 |
8 Intrusion Detection Systems | p. 187 |
Detection Styles | p. 188 |
Signature-Based | p. 188 |
Heuristic | p. 189 |
Host-Based versus Network-Based | p. 190 |
Snort | p. 191 |
Suricata and Sagan | p. 201 |
Bro | p. 203 |
Tripwire | p. 205 |
OSSEC | p. 206 |
Architecture | p. 206 |
Alerting | p. 207 |
Summary | p. 208 |
9 Using Firewall and Application Logs | p. 211 |
Syslog | p. 212 |
Centralized Logging | p. 216 |
Reading Log Messages | p. 220 |
LogWatch | p. 222 |
Event Viewer | p. 224 |
Querying Event Logs | p. 227 |
Clearing Event Logs | p. 231 |
Firewall Logs | p. 233 |
Proxy Logs | p. 236 |
Web Application Firewall Logs | p. 238 |
Common Log Format | p. 240 |
Summary | p. 243 |
10 Correlating Attacks | p. 245 |
Time Synchronization | p. 246 |
Time Zones | p. 246 |
Network Time Protocol | p. 247 |
Packet Capture Times | p. 249 |
Log Aggregation and Management | p. 251 |
Windows Event Forwarding | p. 251 |
Syslog | p. 252 |
Log Management Offerings | p. 254 |
Timelines | p. 257 |
Plaso | p. 258 |
PacketTotal | p. 259 |
Wireshark | p. 261 |
Security Information and Event Management | p. 262 |
Summary | p. 263 |
11 Network Scanning | p. 265 |
Port Scanning | p. 266 |
Operating System Analysis | p. 271 |
Scripts | p. 273 |
Banner Crabbing | p. 275 |
Ping Sweeps | p. 278 |
Vulnerability Scanning | p. 280 |
Port Knocking | p. 285 |
Tunneling | p. 286 |
Passive Data Gathering | p. 287 |
Summary | p. 289 |
12 Final Considerations | p. 291 |
Encryption | p. 292 |
Keys | p. 293 |
Symmetric | p. 294 |
Asymmetric | p. 295 |
Hybrid | p. 296 |
SSL/TLS | p. 297 |
Cloud Computing | p. 306 |
Infrastructure as a Service | p. 306 |
Storage as a Service | p. 309 |
Software as a Service | p. 310 |
Other Factors | p. 311 |
The Onion Router (TOR) | p. 314 |
Summary | p. 317 |
Index | p. 319 |